patch 'net/memif: fix multi-segment Rx corruption' has been queued to stable release 24.11.5

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 24.11.5

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 03/28/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/bluca/dpdk-stable

This queued commit can be viewed at:
https://github.com/bluca/dpdk-stable/commit/6c5e76a41344e0b72a9ac854a2127472e93c8c80

Thanks.

Luca Boccassi

---
>From 6c5e76a41344e0b72a9ac854a2127472e93c8c80 Mon Sep 17 00:00:00 2001
From: Sriram Yagnaraman <sriram.yagnaraman at ericsson.com>
Date: Tue, 24 Mar 2026 17:14:36 +0100
Subject: [PATCH] net/memif: fix multi-segment Rx corruption

[ upstream commit 40e0e7c0a2236adde8c398515619347d9948b8d3 ]

Fix dst_off being reset per-descriptor instead of per-packet in the Rx
slow path. When processing chained descriptors (MEMIF_DESC_FLAG_NEXT),
goto next_slot2 reset dst_off to 0, overwriting the beginning of the
current mbuf with data from subsequent descriptors. Move dst_off
initialization before the next_slot2 label so it is only reset once
per packet.

Add boundary check in both Rx paths before processing next segment.
If MEMIF_DESC_FLAG_NEXT is set but n_slots is 0, free the incomplete
mbuf chain and exit gracefully to prevent reading beyond available
descriptors.

Bugzilla ID: 1609
Fixes: aa17df860891 ("net/memif: add a Rx fast path")

Reported-by: Mike Bly <bly454 at gmail.com>
Signed-off-by: Sriram Yagnaraman <sriram.yagnaraman at ericsson.com>
---
 .mailmap                          |  1 +
 drivers/net/memif/rte_eth_memif.c | 19 +++++++++++++++++--
 drivers/net/memif/rte_eth_memif.h |  1 +
 3 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/.mailmap b/.mailmap
index 4827761a8a..ee1a2c8766 100644
--- a/.mailmap
+++ b/.mailmap
@@ -1052,6 +1052,7 @@ Miguel Bernal Marin <miguel.bernal.marin at linux.intel.com>
 Mihai Brodschi <mihai.brodschi at broadcom.com>
 Mihai Pogonaru <pogonarumihai at gmail.com>
 Mike Baucom <michael.baucom at broadcom.com>
+Mike Bly <bly454 at gmail.com>
 Mike Pattrick <mkp at redhat.com>
 Mike Sowka <msowka at gmail.com>
 Mike Stolarchuk <mike.stolarchuk at bigswitch.com>
diff --git a/drivers/net/memif/rte_eth_memif.c b/drivers/net/memif/rte_eth_memif.c
index a10d71f3ba..28a06abe0a 100644
--- a/drivers/net/memif/rte_eth_memif.c
+++ b/drivers/net/memif/rte_eth_memif.c
@@ -376,6 +376,12 @@ next_slot1:
 			n_slots--;
 
 			if (d0->flags & MEMIF_DESC_FLAG_NEXT) {
+				if (unlikely(n_slots == 0)) {
+					mq->n_err++;
+					rte_pktmbuf_free_bulk(mbufs + rx_pkts,
+							MAX_PKT_BURST - rx_pkts);
+					goto no_free_bufs;
+				}
 				mbuf_tail = mbuf;
 				mbuf = rte_pktmbuf_alloc(mq->mempool);
 				if (unlikely(mbuf == NULL)) {
@@ -414,13 +420,13 @@ next_slot1:
 				goto no_free_bufs;
 			mbuf = mbuf_head;
 			mbuf->port = mq->in_port;
+			dst_off = 0;
 
 next_slot2:
 			s0 = cur_slot & mask;
 			d0 = &ring->desc[s0];
 
 			src_len = d0->length;
-			dst_off = 0;
 			src_off = 0;
 
 			do {
@@ -462,8 +468,14 @@ next_slot2:
 			cur_slot++;
 			n_slots--;
 
-			if (d0->flags & MEMIF_DESC_FLAG_NEXT)
+			if (d0->flags & MEMIF_DESC_FLAG_NEXT) {
+				if (unlikely(n_slots == 0)) {
+					mq->n_err++;
+					rte_pktmbuf_free(mbuf_head);
+					goto no_free_bufs;
+				}
 				goto next_slot2;
+			}
 
 			mq->n_bytes += rte_pktmbuf_pkt_len(mbuf_head);
 			*bufs++ = mbuf_head;
@@ -1602,6 +1614,7 @@ memif_stats_get(struct rte_eth_dev *dev, struct rte_eth_stats *stats)
 		stats->q_ibytes[i] = mq->n_bytes;
 		stats->ipackets += mq->n_pkts;
 		stats->ibytes += mq->n_bytes;
+		stats->ierrors += mq->n_err;
 	}
 
 	tmp = (pmd->role == MEMIF_ROLE_CLIENT) ? pmd->run.num_c2s_rings :
@@ -1632,12 +1645,14 @@ memif_stats_reset(struct rte_eth_dev *dev)
 		    dev->data->rx_queues[i];
 		mq->n_pkts = 0;
 		mq->n_bytes = 0;
+		mq->n_err = 0;
 	}
 	for (i = 0; i < pmd->run.num_s2c_rings; i++) {
 		mq = (pmd->role == MEMIF_ROLE_CLIENT) ? dev->data->rx_queues[i] :
 		    dev->data->tx_queues[i];
 		mq->n_pkts = 0;
 		mq->n_bytes = 0;
+		mq->n_err = 0;
 	}
 
 	return 0;
diff --git a/drivers/net/memif/rte_eth_memif.h b/drivers/net/memif/rte_eth_memif.h
index 8e45a3ab78..bf7ce80b30 100644
--- a/drivers/net/memif/rte_eth_memif.h
+++ b/drivers/net/memif/rte_eth_memif.h
@@ -69,6 +69,7 @@ struct memif_queue {
 	/* rx/tx info */
 	uint64_t n_pkts;			/**< number of rx/tx packets */
 	uint64_t n_bytes;			/**< number of rx/tx bytes */
+	uint64_t n_err;				/**< number of rx/tx errors */
 
 	struct rte_intr_handle *intr_handle;	/**< interrupt handle */
 
-- 
2.47.3

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-03-26 12:56:33.573850985 +0000
+++ 0003-net-memif-fix-multi-segment-Rx-corruption.patch	2026-03-26 12:56:33.397542839 +0000
@@ -1 +1 @@
-From 40e0e7c0a2236adde8c398515619347d9948b8d3 Mon Sep 17 00:00:00 2001
+From 6c5e76a41344e0b72a9ac854a2127472e93c8c80 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 40e0e7c0a2236adde8c398515619347d9948b8d3 ]
+
@@ -20 +21,0 @@
-Cc: stable at dpdk.org
@@ -31 +32 @@
-index 805e5ae762..1d2d2bc7a1 100644
+index 4827761a8a..ee1a2c8766 100644
@@ -34 +35 @@
-@@ -1093,6 +1093,7 @@ Miguel Bernal Marin <miguel.bernal.marin at linux.intel.com>
+@@ -1052,6 +1052,7 @@ Miguel Bernal Marin <miguel.bernal.marin at linux.intel.com>
@@ -43 +44 @@
-index effcee3721..5d153c3a5a 100644
+index a10d71f3ba..28a06abe0a 100644
@@ -46 +47 @@
-@@ -378,6 +378,12 @@ next_slot1:
+@@ -376,6 +376,12 @@ next_slot1:
@@ -59 +60 @@
-@@ -416,13 +422,13 @@ next_slot1:
+@@ -414,13 +420,13 @@ next_slot1:
@@ -74 +75 @@
-@@ -464,8 +470,14 @@ next_slot2:
+@@ -462,8 +468,14 @@ next_slot2:
@@ -90,2 +91,2 @@
-@@ -1607,6 +1619,7 @@ memif_stats_get(struct rte_eth_dev *dev, struct rte_eth_stats *stats,
- 		}
+@@ -1602,6 +1614,7 @@ memif_stats_get(struct rte_eth_dev *dev, struct rte_eth_stats *stats)
+ 		stats->q_ibytes[i] = mq->n_bytes;
@@ -98 +99 @@
-@@ -1639,12 +1652,14 @@ memif_stats_reset(struct rte_eth_dev *dev)
+@@ -1632,12 +1645,14 @@ memif_stats_reset(struct rte_eth_dev *dev)
@@ -114 +115 @@
-index d4e625ab51..9c7a3a93f0 100644
+index 8e45a3ab78..bf7ce80b30 100644